From nobody Wed Dec 17 17:27:43 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE582C636D0 for ; Fri, 24 Nov 2023 00:27:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230139AbjKXA1e (ORCPT ); Thu, 23 Nov 2023 19:27:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230008AbjKXA11 (ORCPT ); Thu, 23 Nov 2023 19:27:27 -0500 Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4202A10C2 for ; Thu, 23 Nov 2023 16:27:33 -0800 (PST) Received: by mail-lj1-x236.google.com with SMTP id 38308e7fff4ca-2c5087d19a6so15825251fa.0 for ; Thu, 23 Nov 2023 16:27:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arista.com; s=google; t=1700785651; x=1701390451; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=zRr0rFRhIAja+Gljgch1Q8003LvnsWZV0PahHhgXGlI=; b=IG3NDI+09K6XuaAP1IfjO+/qnmy/2RtNg73oPRyn1lou9p8f+7IpSPDy3ZvxMFkrbX /JqLgsZDhrK5F6WASpeXpItO+GzMaWGRrN9JdLPS6kZl/gQG9mGtTGtZHuPypei7dEla xWfsGARdMmD2yDjX95Xg8eK7SSVrF/RLsES1Epp/gk8d0+YRIk4Va55DnwJcsFaoSavJ ru0JO97OVDfwq19izDgfmKcV2+pc5dcJI4tlNiqdHRpvRxWtt7rGAFnXqjDd7e0QWeoy l9mbKI3SBlQi1y8BJgDa3TT6kp7c2cLqzNMyVHBk5+u7JnVqp1LmqBEM6/4epag+8Ew3 HccQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700785651; x=1701390451; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zRr0rFRhIAja+Gljgch1Q8003LvnsWZV0PahHhgXGlI=; b=Jf1vkNYntgL+0xjvhUO3lXOWE3F7MHC6BH5FmKWn5z8szpzRuAcI7O+xod8TjjJvTh gGPZiegUEUSUxFkfve4PY1gBLqXgfPmeTtugyPRX0Sqni9FXn/LJeGkSSzNgXtiFq9dL NAhV9MAyFtL8ekgiTvM4h5C8+3SZl9jmVOvSzR9YCp7Pa5FzkM0N040QlXk8k2CV2B+4 Lm+tw1ZmeI7O1LqAT6qhtDNEWOptKVRS1RveOozWHWOftkMWFmf+z8Jo0kdd86uPfywc q0ygohYi3Y99aVI/q12xdmqR6O3gZv19Br9TVtRh1OllzMgu7BM/TbE7Dr4u5u3oHksa SV6Q== X-Gm-Message-State: AOJu0YxAgXZoixhbJglvirLdSpDMmrtE2PQOvQJEsZKK6FZvC7frTx3Q DNDm/vOdebUUDizzMZwkXBXrBw== X-Google-Smtp-Source: AGHT+IECNSLVVGbdrioLI0SEhRdQ/Bu8ddJ4oMGkht/Q/SYm0am/9reyIFf79jCbTgCBwH7mtPYWpA== X-Received: by 2002:a2e:7d18:0:b0:2c8:330b:7181 with SMTP id y24-20020a2e7d18000000b002c8330b7181mr632580ljc.38.1700785651438; Thu, 23 Nov 2023 16:27:31 -0800 (PST) Received: from Mindolluin.ire.aristanetworks.com ([217.173.96.166]) by smtp.gmail.com with ESMTPSA id g9-20020a05600c310900b004094e565e71sm3453230wmo.23.2023.11.23.16.27.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Nov 2023 16:27:30 -0800 (PST) From: Dmitry Safonov To: David Ahern , Eric Dumazet , Paolo Abeni , Jakub Kicinski , "David S. Miller" Cc: linux-kernel@vger.kernel.org, Dmitry Safonov , Dmitry Safonov <0x7f454c46@gmail.com>, Francesco Ruggeri , Salam Noureddine , Simon Horman , netdev@vger.kernel.org Subject: [PATCH v2 2/7] net/tcp: Consistently align TCP-AO option in the header Date: Fri, 24 Nov 2023 00:27:15 +0000 Message-ID: <20231124002720.102537-3-dima@arista.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231124002720.102537-1-dima@arista.com> References: <20231124002720.102537-1-dima@arista.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Currently functions that pre-calculate TCP header options length use unaligned TCP-AO header + MAC-length for skb reservation. And the functions that actually write TCP-AO options into skb do align the header. Nothing good can come out of this for ((maclen % 4) !=3D 0). Provide tcp_ao_len_aligned() helper and use it everywhere for TCP header options space calculations. Fixes: 1e03d32bea8e ("net/tcp: Add TCP-AO sign to outgoing packets") Signed-off-by: Dmitry Safonov --- include/net/tcp_ao.h | 6 ++++++ net/ipv4/tcp_ao.c | 4 ++-- net/ipv4/tcp_ipv4.c | 4 ++-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 6 +++--- net/ipv6/tcp_ipv6.c | 2 +- 6 files changed, 15 insertions(+), 9 deletions(-) diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index b56be10838f0..647781080613 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -62,11 +62,17 @@ static inline int tcp_ao_maclen(const struct tcp_ao_key= *key) return key->maclen; } =20 +/* Use tcp_ao_len_aligned() for TCP header calculations */ static inline int tcp_ao_len(const struct tcp_ao_key *key) { return tcp_ao_maclen(key) + sizeof(struct tcp_ao_hdr); } =20 +static inline int tcp_ao_len_aligned(const struct tcp_ao_key *key) +{ + return round_up(tcp_ao_len(key), 4); +} + static inline unsigned int tcp_ao_digest_size(struct tcp_ao_key *key) { return key->digest_size; diff --git a/net/ipv4/tcp_ao.c b/net/ipv4/tcp_ao.c index 7696417d0640..c8be1d526eac 100644 --- a/net/ipv4/tcp_ao.c +++ b/net/ipv4/tcp_ao.c @@ -1100,7 +1100,7 @@ void tcp_ao_connect_init(struct sock *sk) ao_info->current_key =3D key; if (!ao_info->rnext_key) ao_info->rnext_key =3D key; - tp->tcp_header_len +=3D tcp_ao_len(key); + tp->tcp_header_len +=3D tcp_ao_len_aligned(key); =20 ao_info->lisn =3D htonl(tp->write_seq); ao_info->snd_sne =3D 0; @@ -1346,7 +1346,7 @@ static int tcp_ao_parse_crypto(struct tcp_ao_add *cmd= , struct tcp_ao_key *key) syn_tcp_option_space -=3D TCPOLEN_MSS_ALIGNED; syn_tcp_option_space -=3D TCPOLEN_TSTAMP_ALIGNED; syn_tcp_option_space -=3D TCPOLEN_WSCALE_ALIGNED; - if (tcp_ao_len(key) > syn_tcp_option_space) { + if (tcp_ao_len_aligned(key) > syn_tcp_option_space) { err =3D -EMSGSIZE; goto err_kfree; } diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 5f693bbd578d..0c50c5a32b84 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -690,7 +690,7 @@ static bool tcp_v4_ao_sign_reset(const struct sock *sk,= struct sk_buff *skb, =20 reply_options[0] =3D htonl((TCPOPT_AO << 24) | (tcp_ao_len(key) << 16) | (aoh->rnext_keyid << 8) | keyid); - arg->iov[0].iov_len +=3D round_up(tcp_ao_len(key), 4); + arg->iov[0].iov_len +=3D tcp_ao_len_aligned(key); reply->doff =3D arg->iov[0].iov_len / 4; =20 if (tcp_ao_hash_hdr(AF_INET, (char *)&reply_options[1], @@ -978,7 +978,7 @@ static void tcp_v4_send_ack(const struct sock *sk, (tcp_ao_len(key->ao_key) << 16) | (key->ao_key->sndid << 8) | key->rcv_next); - arg.iov[0].iov_len +=3D round_up(tcp_ao_len(key->ao_key), 4); + arg.iov[0].iov_len +=3D tcp_ao_len_aligned(key->ao_key); rep.th.doff =3D arg.iov[0].iov_len / 4; =20 tcp_ao_hash_hdr(AF_INET, (char *)&rep.opt[offset], diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index a9807eeb311c..9e85f2a0bddd 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -615,7 +615,7 @@ struct sock *tcp_create_openreq_child(const struct sock= *sk, ao_key =3D treq->af_specific->ao_lookup(sk, req, tcp_rsk(req)->ao_keyid, -1); if (ao_key) - newtp->tcp_header_len +=3D tcp_ao_len(ao_key); + newtp->tcp_header_len +=3D tcp_ao_len_aligned(ao_key); #endif if (skb->len >=3D TCP_MSS_DEFAULT + newtp->tcp_header_len) newicsk->icsk_ack.last_seg_size =3D skb->len - newtp->tcp_header_len; diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index eb13a55d660c..93eef1dbbc55 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -825,7 +825,7 @@ static unsigned int tcp_syn_options(struct sock *sk, st= ruct sk_buff *skb, timestamps =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_timestamps); if (tcp_key_is_ao(key)) { opts->options |=3D OPTION_AO; - remaining -=3D tcp_ao_len(key->ao_key); + remaining -=3D tcp_ao_len_aligned(key->ao_key); } } =20 @@ -915,7 +915,7 @@ static unsigned int tcp_synack_options(const struct soc= k *sk, ireq->tstamp_ok &=3D !ireq->sack_ok; } else if (tcp_key_is_ao(key)) { opts->options |=3D OPTION_AO; - remaining -=3D tcp_ao_len(key->ao_key); + remaining -=3D tcp_ao_len_aligned(key->ao_key); ireq->tstamp_ok &=3D !ireq->sack_ok; } =20 @@ -982,7 +982,7 @@ static unsigned int tcp_established_options(struct sock= *sk, struct sk_buff *skb size +=3D TCPOLEN_MD5SIG_ALIGNED; } else if (tcp_key_is_ao(key)) { opts->options |=3D OPTION_AO; - size +=3D tcp_ao_len(key->ao_key); + size +=3D tcp_ao_len_aligned(key->ao_key); } =20 if (likely(tp->rx_opt.tstamp_ok)) { diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 937a02c2e534..8c6623496dd7 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -881,7 +881,7 @@ static void tcp_v6_send_response(const struct sock *sk,= struct sk_buff *skb, u32 if (tcp_key_is_md5(key)) tot_len +=3D TCPOLEN_MD5SIG_ALIGNED; if (tcp_key_is_ao(key)) - tot_len +=3D tcp_ao_len(key->ao_key); + tot_len +=3D tcp_ao_len_aligned(key->ao_key); =20 #ifdef CONFIG_MPTCP if (rst && !tcp_key_is_md5(key)) { --=20 2.43.0